Bound atom_get_vbios_build() by the BIOS size to avoid out-of-bounds reads.
Signed-off-by: Lijo Lazar <[email protected]> --- drivers/gpu/drm/amd/amdgpu/atom.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c index 0f6def9c3318..21ca934af26e 100644 --- a/drivers/gpu/drm/amd/amdgpu/atom.c +++ b/drivers/gpu/drm/amd/amdgpu/atom.c @@ -1568,6 +1568,10 @@ static void atom_get_vbios_build(struct atom_context *ctx) uint16_t base, len; base = CU16(ATOM_ROM_TABLE_PTR); + + if (base + ATOM_ROM_CFG_PTR + 1 >= ctx->bios_size) + return; + atom_rom_hdr = CSTR(base); str = CSTR(CU16(base + ATOM_ROM_CFG_PTR)); -- 2.49.0
